Privacy policy

Personal data processing policy for api.docinspect.ru. Operator: sole proprietor P. D. Belov (Russia). Revision of 10 September 2026.

1. Data controller

Sole proprietor P. D. Belov, TIN (INN) 771888412003, PSRN (OGRNIP) 323774600786813. Contact: info@docinspect.ru, the form on the site or Telegram.

2. What we process

• Site visitors: IP address, browser data, analytics cookies (with consent). Kept for up to 2 years.
• Lead form: name, phone, email, company, comment. Kept for 1 year after the last contact.
• Dashboard users: email address; IP address and browser data at sign-in; a log of dashboard and API actions (time, operation type, volume in pages, no document contents); API keys; plan and payment records without card numbers; referral source (UTM). Account data is kept until the account is deleted plus 30 days; sign-in logs for 1 year; payment records for 5 years.
• Representatives of corporate customers: name, position, email and phone in correspondence and invoices, for the term of the contract plus 5 years for accounting records.
• Consent log: time, IP address, browser data, form and policy versions, the text shown. Kept for 3 years after the last event.

3. What we do not process

Documents sent to the API are processed statelessly and are not stored. Personal data inside documents is scrubbed before any external LLM call (fail_closed mode).

4. Purposes and legal basis

Responding to requests (consent given in the form). Providing the service: sign-in, API keys, quota accounting, billing, and service emails that are part of the service — sign-in links, key and quota notices, terms for continuing after the free volume is used up, payment and subscription notices, and getting-started instructions in the first days after registration (performance of the contract, Article 6(1)(5) of 152-FZ). Legal obligations: tax and accounting records. Product news and articles are sent only with a separate, revocable consent; withdrawing it does not affect the service.

5. Cookies and web analytics

The site uses two kinds of cookies. Essential cookies: the dashboard session and your stored cookie choice; the dashboard does not work without them and they need no consent. Analytics cookies: the Yandex Metrica counter (Yandex LLC, Russia) including Session Replay. Analytics cookies are set only after you agree in the banner; until then the counter is not loaded. Form field contents are never recorded (fields carry the ym-disable-keys class). You can change or withdraw your choice via the “Cookie settings” link in the footer or by deleting cookies in your browser; analytics data is retained for no longer than 2 years. Each grant and withdrawal of cookie consent is recorded in the operator’s log: time, IP address, browser data, banner and policy versions, and a technical consent identifier (a 12-month cookie). Legal basis — Article 9(3) of 152-FZ (the controller must prove that consent was obtained); records are kept for 3 years after the last event.

6. Storage and localisation

Recording, systematisation, accumulation and storage of personal data of Russian citizens are carried out in a database located in the Russian Federation (Article 18(5) of Federal Law No. 152-FZ). Data is kept for the time required by the purpose; after consent is withdrawn or the purpose is achieved, personal data is destroyed within 30 days (Article 21 of 152-FZ), except payment and billing records kept for 5 years under tax and accounting law.

Processor acting on the controller’s instructions (Article 6(3) of 152-FZ): Yandex LLC (Yandex 360 mail and Yandex Metrica analytics), under signed data-processing agreements. Machine-learning model providers (Yandex Cloud, Cloud.ru; servers in Russia) receive no personal data: document text is anonymised before transfer in fail-closed mode (an external call is refused if personal data remains), request logging at the provider is disabled, and requests are not used for training. Card payments are handled by JSC TBank (T-Kassa) as an independent controller; card numbers never reach the site operator.

Security measures (Articles 18.1 and 19 of 152-FZ): role-based access to data limited to the operator; TLS for all transfers; storage in the Russian Federation; backups; access and action logging; automatic anonymisation of document text before any external model call; API keys stored as hashes; incidents affecting personal data are assessed within 24 hours and reported to Roskomnadzor and affected customers as required by Article 21(3.1) of 152-FZ.

7. Cross-border transfers

No cross-border transfer of personal data takes place: all recipients are located in the Russian Federation. Internal service systems receive events under a pseudonymous identifier, without name, email, phone or company details.

8. Your rights

Access, correction, deletion, withdrawal of consent: see the consent document. Requests go to info@docinspect.ru and are answered within 10 business days (Articles 14(7) and 20(1) of 152-FZ), extendable by up to 5 business days with notice of the reasons.